CVE-2025-13223

Published Nov 17, 2025

Last updated a month ago

Google Chrome V8

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-13223 is a type confusion vulnerability in the V8 JavaScript and WebAssembly engine of Google Chrome. This flaw allows a remote attacker to potentially exploit heap corruption through a crafted HTML page. Google's Threat Analysis Group (TAG) discovered the vulnerability, confirming that an exploit for it exists in the wild. The vulnerability occurs when the V8 engine misinterprets data types, leading to memory corruption. Successful exploitation could allow attackers to bypass Chrome's sandbox protections and execute arbitrary code on a victim's system. To address this zero-day vulnerability, Google released an emergency update for the Chrome Stable channel.

Description: Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Source: chrome-cve-admin@google.com
NVD status: Analyzed
Products: chrome

Risk scores

CVSS 3.1

Type: Secondary
Base score: 8.8
Impact score: 5.9
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity: HIGH

Known exploits

Data from CISA

Vulnerability name: Google Chromium V8 Type Confusion Vulnerability
Exploit added on: Nov 19, 2025
Exploit action due: Dec 10, 2025
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

nvd@nist.gov: CWE-843
134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-843

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A3F3CAD1-884B-471E-8FDF-F42DA3DC356E",
            "versionEndExcluding": "142.0.7444.175"
          }
        ],
        "operator": "OR"
      },
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*",
            "vulnerable": false,
            "matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E"
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*",
            "vulnerable": false,
            "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
            "vulnerable": false,
            "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"
          }
        ],
        "operator": "OR"
      }
    ],
    "operator": "AND"
  }
]

References

Sources include official advisories and independent security research.